|
| 1 | +--- |
| 2 | +title: '3.2 PostgreSQL database [OPTIONAL]' |
| 3 | +layout: default |
| 4 | +nav_order: 3 |
| 5 | +parent: 'Lab 2: Migrate to Azure Container Apps' |
| 6 | +--- |
| 7 | + |
| 8 | +# Create an Azure PostgreSQL Database service |
| 9 | + |
| 10 | +You now have the compute service that will host your applications and the config server that will be used by your migrated application. Before you start deploying individual microservices as Azure Container Apps, you need to first create an Azure Database for PostgreSQL Flexible Server-hosted database for them. To accomplish this, you can use the following guidance: |
| 11 | + |
| 12 | +- [Quickstart: Create an Azure Database for PostgreSQL Flexible Server using Azure CLI](https://learn.microsoft.com/azure/PostgreSQL/flexible-server/quickstart-create-server-cli). |
| 13 | + |
| 14 | +You will also need to update the config for your applications to use the newly provisioned PostgreSQL Server. This will involve updating the application.yml config file in your private git config repo with the values provided in the PostgreSQL Server connection string. |
| 15 | + |
| 16 | +Your PostgreSQL database will also have a firewall enabled. This firewall will by default block all incoming calls. You will need to open this firewall in case you want to connect to it from your microservices running in the ACA environment. |
| 17 | + |
| 18 | +## Step by step guidance |
| 19 | + |
| 20 | +1. Run the following commands to create an instance of PostgreSQL Flexible server. Note that the name of the server must be globally unique, so adjust it accordingly in case the randomly generated name is already in use. Keep in mind that the name can contain only lowercase letters, numbers and hyphens. In addition, replace the `<sqladmin-password>` placeholder with a complex password and record its value. |
| 21 | + {: .note } |
| 22 | + > Here we use PostgreSQL admin password for apps to connect to sql server, this is for demo/test/learn purpose, not recommand in production environment. Please refer to [Lab 04: Connect to Database securely using identity](https://azure-samples.github.io/java-microservices-aca-lab/docs/04_lab_secrets/04_openlab_secrets_aca.html) for the secured managed identity solution. |
| 23 | +
|
| 24 | + ```bash |
| 25 | + POSTGRES_SERVER_NAME=postgres-$APPNAME-$UNIQUEID |
| 26 | + POSTGRES_ADMIN_USERNAME=sqladmin |
| 27 | + POSTGRES_ADMIN_PASSWORD="<sqladmin-password>" |
| 28 | + DATABASE_NAME=petclinic |
| 29 | + |
| 30 | + az postgres flexible-server create \ |
| 31 | + --admin-user myadmin \ |
| 32 | + --admin-password "$POSTGRES_ADMIN_PASSWORD" \ |
| 33 | + --name "$POSTGRES_SERVER_NAME" \ |
| 34 | + --resource-group "$RESOURCE_GROUP" |
| 35 | + ``` |
| 36 | + |
| 37 | + {: .note } |
| 38 | + > During the creation you will be asked whether access for your IP address should be added and whether access for all IP's should be added. Answer `n` for no on both questions. |
| 39 | +
|
| 40 | + {: .note } |
| 41 | + > In case this statement fails with the message `ERROR: Unable to prompt for confirmation as no tty available`, add the `--yes` flag to the above statement. This will auto-install any missing resource providers. |
| 42 | + |
| 43 | + {: .note } |
| 44 | + > Wait for the provisioning to complete. This might take about 3 minutes. |
| 45 | +
|
| 46 | +1. Once the Azure Database for PostgreSQL Flexible Server instance gets created, it will output details about its settings. In the output, you will find the server connection string. Record its value since you will need it later in this exercise. |
| 47 | + |
| 48 | +1. Run the following commands to create a database in the Azure Database for PostgreSQL Flexible Server instance. |
| 49 | + |
| 50 | + ```bash |
| 51 | + az postgres flexible-server db create \ |
| 52 | + --server-name $POSTGRES_SERVER_NAME \ |
| 53 | + --resource-group $RESOURCE_GROUP \ |
| 54 | + -d $DATABASE_NAME |
| 55 | + ``` |
| 56 | + |
| 57 | +1. You will also need to allow connections to the server from your ACA environment. For now, to accomplish this, you will create a server firewall rule to allow inbound traffic from all Azure Services. |
| 58 | + |
| 59 | + Check the status of your sql server |
| 60 | +  |
| 61 | + |
| 62 | + Checking `Allow Azure services and resources to access this server` adds an IP based firewall rule with start and end IP address of `0.0.0.0`, See [Connections from inside Azure](https://learn.microsoft.com/en-us/azure/azure-sql/database/firewall-configure?view=azuresql#connections-from-inside-azure). |
| 63 | + |
| 64 | + This way your apps running in Azure Container Apps will be able to reach the PostgreSQL database. In one of the upcoming exercises, you will restrict this connectivity to limit it exclusively to the apps hosted by your ACA. |
| 65 | + |
| 66 | + ```bash |
| 67 | + az postgres flexible-server firewall-rule create \ |
| 68 | + --rule-name allAzureIPs \ |
| 69 | + --name $POSTGRES_SERVER_NAME \ |
| 70 | + --resource-group $RESOURCE_GROUP \ |
| 71 | + --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0 |
| 72 | + ``` |
| 73 | + |
| 74 | + Check the sql server firewall rules with command |
| 75 | + ```bash |
| 76 | + az postgres flexible-server firewall-rule list \ |
| 77 | + --name $POSTGRES_SERVER_NAME \ |
| 78 | + --resource-group $RESOURCE_GROUP \ |
| 79 | + ``` |
| 80 | + |
| 81 | +1. From the Git Bash window, in the config repository you cloned locally, use your favorite text editor to open the _application.yml_ file. Replace the full contents of the _application.yml_ file with the contents of [this application.yml](0203_postgres_application.yaml) file. The updated _application.yml_ file includes the following changes: |
| 82 | + |
| 83 | + * It removes the default `0` value for the `server.port` on line 5. |
| 84 | + * It changes the default `spring.sql.init` values to use `PostgreSQL` configuration on lines 15 to 19. |
| 85 | + * It adds a `spring.datasource` property for your PostgreSQL database on lines 10 to 14. |
| 86 | + * It adds extra `eureka` config on lines 61 to 66. |
| 87 | + * It removes the `chaos-monkey` and `PostgreSQL` profiles. |
| 88 | + |
| 89 | +1. In the part you pasted, update the values of the target datasource endpoint on line 6, the corresponding admin user account on line 7, and its password on line 8 to match your configuration. Set these values by using the information in the Azure Database for PostgreSQL Flexible Server connection string you recorded earlier in this task. |
| 90 | + |
| 91 | +1. Save the changes and push the updates you made to the _application.yml_ file to your private GitHub repo by running the following commands from the Git Bash prompt: |
| 92 | + |
| 93 | + ```bash |
| 94 | + git add . |
| 95 | + git commit -m 'azure postgres info' |
| 96 | + git push |
| 97 | + ``` |
| 98 | + |
| 99 | + {: .note } |
| 100 | + > At this point, the admin account user name and password are stored in clear text in the application.yml config file. In one of upcoming exercises, you will remediate this potential vulnerability by removing clear text credentials from your configuration. |
| 101 | + |
0 commit comments